The facts are still coming out about the crash of Malaysian Flight MH-17 in eastern Ukraine on Thursday, but following is my take on what shot the plane down and who is likely responsible.

The Known Knowns (what lawyers would call “stipulated facts”)

Malaysian Flt MH-17 from Amsterdam to Kuala Lampur crashed in the late afternoon on Thursday in eastern Ukraine, killing all 298 of those on board, including 283 passengers and 15 crew. Of those, 193 were Dutch nationals (of whom one had dual Dutch/US citizenship), and 43 were Malaysians (including the crew). The crash site is about 10 miles from the Russian border near the town of Grabovo in Donetsk oblast. The plane exploded in mid-air, and the explosion that brought it down appears to have taken place less then 10 miles from the crash site, so around 20 miles from the Russian border. The plane was flying at approximately 33,000 feet in a relatively well-trafficked commercial corridor (Airway L980), just above the restricted zone of 32,000 feet.

At this point, it can be said with virtual certainty that the plane was brought down by a surface-to-air missile (SAM). A mechanical failure, onboard terrorist incident, or an attack by a fighter jet using an air-to-air missile are extremely unlikely, although investigators will need to confirm that. NATO has had AWACs surveillance planes permanently patrolling over Poland and Romania to monitor the crisis for months now, and U.S. and other Western intelligence services have also been using satellites and other national technical means to gather intelligence not only on eastern Ukraine but on Russian troop movements as well. US intelligence sources reported on Thursday that they tracked a missile that struck the plane, and yesterday President Obama reported that US intelligence had concluded that the missile had been launched from eastern Ukraine in territory controlled by the separatists.

What is not yet entirely clear is (1) the type of SAM that brought down the plane; (2) who operated the missile system, and (3) the provenance of the missile. Let me address each of these in turn.

What kind of missile was used?

In an earlier post, I considered the possibility that the Russian military and/or security organs were providing the separatists with so-called MANPADs (Man-portable Air Defense Systems), which is military jargon for shoulder-fired surface-to-air missiles (see photo). It was clear at the time that the separatists had a large stockpile of MANPADs (there is plenty of photographic evidence of that), but I thought that they had likely obtained them by capturing Ukrainian military facilities because I assumed that the Kremlin would not want these very dangerous weapons, which are capable of bringing down low-flying commercial planes, in the hands of fighters that they did not control.

I am now much less confident of that. I have seen no clear evidence that the separatists have received MANPADS from the Russians, but there is overwhelming evidence that Russian security services have been facilitating the movement of armored vehicles, fighters, and trucks across the border. Those trucks could certainly be carrying MANPADs, but unlike the armored columns and the trucks themselves, people standing on the road with smart phones would not be able to video or photograph them.

What makes it considerably more likely that the Russians are supplying the separatists with MANPADs is evidence (multiple photographs and videos, as well as journalist reports) that the Russians delivered at least one mobile SAM battery, called a Strela-10, earlier this month, to the separatists. The Strela-10 (the NATO designation is SA-13) is deployed from a truck (see photo), which accounts for the photographic and video evidence. (One notable aspect of this conflict is that digital cameras, smart phones, and social media has meant that people following the Internet are probably getting the kind of real time intelligence that intelligence agencies in the past could only dream of.) If the Russians have been providing the separatists with Strela-10 batteries, they have probably been providing them with less powerful MANPADs as well.

However, neither a MANPAD nor a Strela-10 has the range to bring down a plane flying at 33,000 feet. Nor could either have brought down the military transport plane (AN-26) on Monday, which was reportedly flying at 21,000 feet. The MANPADs that the separatist are known to possess are called Iglas in Russian military parlance, of which there are a variety of types (the NATO designations are SA-16, SA-18, and SA-24). An Igla-S was said by Ukrainian sources to have brought down an IL-76 transport plane that was trying to land at Luhansk airport on June 14, killing all 49 on board. The Igla-S has a maximum intercept altitude of around 11,000 feet, and the figure is about the same for other versions of the Igla. The maximum intercept altitude for the Strela-10 is only a bit higher, around 11,500 feet. Clearly, then, neither an Igla nor a Strela-10 could have brought down the AN-26 at 21,000 feet. Even more clearly, neither could have hit MH-17 flying at 33,000 feet yesterday.

If, as President Obama indicated yesterday, the missile that brought down MH-17 was fired from Ukrainian territory, it is extremely likely that the SAM was a so-called Buk missile (NATO distinguishes two types, designated SA-11 or SA-17), as first reported by Ukrainian officials. The Buk (which means beech tree in Russian) has a maximum intercept range of over 70,000 feet. If the weapon that brought down the AN-26 was fired from Ukrainian territory as well, which seems highly likely (the separatists happily claimed credit for doing so), it is also highly likely that it, too, was a Buk.

There is no evidence that the separatists have any other SAM system capable of reaching 21,000 and 33,000 feet, which means the only plausible alternative is the launching of new generation S-300 (NATO designation SA-10) or S-400 missiles (NATO designation SA-21) from Russian territory. The New York Times reported that Western intelligence sources had told them that the Russians have at least two SAM batteries deployed near the border in the region of the crash. However, President Obama’s statement suggested that Western intelligence has ruled out the possibility that MH-17 was brought down by a missile fired from across the border. The Wall Street Journal has also reported that US intelligence has concluded that the missile was a Buk SA-11. Moreover, the Buk is controlled by radar that is part of the mobile battery itself and, unlike the S-300 or S-400, is not integrated into national radar air defense networks, and older versions are reportedly not equipped with radar that can easily distinguish commercial from military aircraft using the new identification systems. It is therefore extremely unlikely that a Russian-operated S-300 or S-400 would accidently shoot down a commercial flight, but it is much less unlikely that operators of a Buk using its own radar system would mistake a commercial jet for a military transport plane and shoot it down.

Who fired the missile?

It is conceivable that MH-17 was brought down by an accidental launching of a missile system controlled by the Ukrainians, as the separatists have claimed, and that possibility is something that investigators are obviously going to consider. What makes the assertion less implausible is an incident from 2001, when the Ukrainian military was conducing exercises in Crimea and mistakenly shot down an Air Siberia flight going from Tel Aviv to Novosibirsk, killing everyone on board. Notably, however, Putin has not claimed that the Ukrainians shot down MH-17, at least not yet – what he has said is that the Ukrainian government is responsible for the tragedy because it is responsible for the conflict itself. Russian military spokesmen have, however, pointed out that Ukraine has many Buk and other sophisticated SAM batteries, and that a large number of them have been deployed in or near the conflict zone.

There is, however, no evidence that the Ukrainians fired a SAM on Thursday, and the claim seems particularly implausible given the destruction of the AN-26 by a high-altitude SAM on Monday. That would mean two accidental launchings in three days. Those would also have been the only instances when the Ukrainian military used SAMs in the conflict – they have had no need to, given that Russian military incursions into their airspace have been limited (although the Ukrainians claimed that a Russian fighter shot down one of Ukraine’s Su-25 ground support warplanes on Wednesday near the Russian border). Two-for-two friendly fire incidents is very hard to believe. Moreover, MH-17 was flying in a well-traveled commercial air corridor from west to east, and there would have been absolutely no reason for a Ukrainian radar operator to identify it as hostile.

In contrast, there is a great deal of evidence that the separatists fired the SAM that brought down MH-17. Kyiv has made public two recordings of conversations involving separatist commanders (and according to the Ukrainians, one Russian intelligence officer, although there is no way to confirm the latter claim). In the first recording, a voice is heard saying that the separatists had shot down a plane, and in the second a voice is heard saying he was at the crash site and it turned out that the plane was full of civilians. In addition, the DPR’s military commander, Igor Girkin (Strelkov) posted an entry yesterday on his VKontakte page (a popular Russian social media site) boasting that the separatists had brought down another plane and saying that the Ukrainians had been warned to stay out of the airspace above the conflict zone. (“We already warned them – not to fly in “our sky”). When it became clear the plane was a commercial airliner, the entry was quickly edited to remove the boast and the warning, but it had already been noted and recorded and is still widely available on the Internet. There are claims in the blogosphere that the entry was a fake carried out by Ukrainian security services, but that is very unlikely given what it implies, which is not an accidental launching by the Ukrainians but a planned, covert operation to murder 298 civilians in an effort to discredit the separatists. That strikes me as extremely unlikely under any circumstances, but it is particularly unlikely given that Kyiv is trying to secure support from the international community and would surely know that Western intelligence would likely identify the source of the firing.

Finally, there are now photographs, video, and eyewitness accounts by journalists and others of at least one and possibly two Buk systems under the control of the separatists. The separatists also claimed in a Tweet on June 29 that they were in possession of Buks (that Tweet has since been removed). The mobile systems have now been photographed on the move in the area where the airliner was brought down, and there are reports that two of the four missile tubes on the launcher are empty.

Where did the Buk system(s) originate?

If MH-17 was indeed brought down by the separatists using a Buk missile battery, the question then becomes where did the separatists obtain the weapon? The Ukrainian military says it has a total of 60 Buk launchers, and the Russian news service ITAR-Tass reported on June 29 that the separatists had overrun a Ukrainian air defense base that contained one or more Buk missile batteries. There was, however, no confirmation of that claim by the Ukrainian military at the time. My impression is that the Ukrainians have been forthright about their losses, including quick acknowledgement of the loss of key facilities, downed planes, captured armor, and so on. (On the other hand, they have often exaggerated losses by the separatists). Given the military and political significance of the capture of a Buk by the separatists, as well as the danger that would pose to commercial traffic in the area, I think the Ukrainians would be taking a huge risk not making the loss public, and in particular if they did not inform air traffic controllers. I also assume that the Ukrainian military would have gone to great lengths to deny the separatists control of such a powerful and dangerous weapon, or at least to disable them before they fell into separatist hands. Yesterday, Ukrainian officials explicitly denied that the separatists had ever captured any of their Buk systems. I also assume that journalists would have covered the capture of an air defense base and that there would be video evidence, as there has been for other assaults on Ukrainian bases. To my knowledge, the only claim that the separatists had captured a Buk from the Ukrainian military was the one ITAR-Tass report.

Moreover, it is clear that part of the Russian maskirovka campaign in eastern Ukraine consists of leaking false reports that the separatists have captured weapons that the Russians are about to deliver to them. The Itar-TASS report was apparently based on separate reports from TV Zvezda, the news service of the Russian Defense Ministry.

Accordingly, I think the most likely explanation is that the Buk that brought down MH-17 was provided by the Russians.

Summary

It now appears highly likely that MH-17 was brought down by a separatist-controlled Buk that was launched from territory controlled by the separatists. As for the provenance of the Buk, it is possible that the separatists captured it from the Ukrainians, but there is no credible evidence of that, and I think it is more likely that they obtained the system from Russia.

If that turns out to be the case, my guess is that the sequence of events went roughly as follows. In the wake of the Ukrainian military successes in Slavyansk and elsewhere last week, the Kremlin ordered the Russian military and security organs to do whatever was necessary to keep the border open and prevent supply lines into Luhansk and Donetsk from being closed. To that end, the Russians began stepping up military activity along the border, including rocket fire from Russian territory (for which there is also pretty good video evidence) to prevent key border crossings from coming under Ukrainian control. They also decided to deny Ukraine control of the airspace over the conflict zone. As a result, they shot down an SU-25 close to the border with an air-to-air missile from one of their fighters on Wednesday.

Rather than abandoning efforts to keep their support for the separatists covert by openly violating Ukrainian airspace, however, they decided to supply them with more effective SAM systems, including first one or more Strela-10s and then one or more Buks. At least some of the people operating the system were likely former or current professional Russian soldiers with the technical expertise to operate the systems and who were recruited for the operation by Russian security agents and who coordinated their activities with Russian intelligence. Finally, I suspect that those operators, using their independent Buk-system radar, confused MH-17 for a AN-26, bringing down the commercial airliner and killing 298 civilians.